build: Add a toolchain preflight and pin GoReleaser in CI #19

Merged

linus merged 1 commit from ash/toolchain-preflight-14 into develop

2026-10-24 08:28:45 +00:00

ash commented

2026-10-24 08:10:38 +00:00

Collaborator

Closes #14

What changed

scripts/check-toolchain.sh: an unchanged copy of the forge-standards script.
New Makefile: build (go build -o teleport ./cmd/teleport) and test both run check-toolchain first.
go.mod: adds toolchain go1.27.2.
.forgejo/workflows/test-pr.yaml: setup-go@main becomes @v5, and the preflight now runs after setup-go.
.forgejo/workflows/release-tag.yaml:
- setup-go@v5, with the preflight after it.
- goreleaser-action@master becomes @v6 with version: v2.18.3, replacing latest.
README: the build section now uses make build and explains what the check covers and how to fix a mismatch.

actions/checkout@main is unchanged because it's out of scope for #14.

Proof (make on a clean clone of this commit)

Right toolchain (go1.27.x): make build produces teleport.
Fake Go reporting go1.26.5: make build and make test both stop at check-toolchain and print found go1.26.5, required go1.27.2, and the fix. Nothing is built, and git status stays clean.
Changing the go.mod toolchain line to go1.27.9 is caught: "pins changed since the last commit", with found, required and fix.

Tests: go test -race ./...: 73 passed, 0 failed. goimports -l is clean.

Closes #14 **What changed** - `scripts/check-toolchain.sh`: an unchanged copy of the forge-standards script. - New `Makefile`: `build` (`go build -o teleport ./cmd/teleport`) and `test` both run `check-toolchain` first. - `go.mod`: adds `toolchain go1.27.2`. - `.forgejo/workflows/test-pr.yaml`: `setup-go@main` becomes `@v5`, and the preflight now runs after setup-go. - `.forgejo/workflows/release-tag.yaml`: - `setup-go@v5`, with the preflight after it. - `goreleaser-action@master` becomes `@v6` with `version: v2.18.3`, replacing `latest`. - README: the build section now uses `make build` and explains what the check covers and how to fix a mismatch. `actions/checkout@main` is unchanged because it's out of scope for #14. **Proof** (`make` on a clean clone of this commit) - Right toolchain (go1.27.x): `make build` produces `teleport`. - Fake Go reporting go1.26.5: `make build` and `make test` both stop at check-toolchain and print found go1.26.5, required go1.27.2, and the fix. Nothing is built, and `git status` stays clean. - Changing the go.mod toolchain line to go1.27.9 is caught: "pins changed since the last commit", with found, required and fix. **Tests:** `go test -race ./...`: 73 passed, 0 failed. `goimports -l` is clean.

ash added 1 commit

2026-10-24 08:10:38 +00:00

build: Add a toolchain preflight and pin CI actions

CI / check-and-test (pull_request) Successful in 31s

Details

ba982d4086

Adds scripts/check-toolchain.sh (forge-standards copy) and a Makefile
whose build/test run it first, runs it in CI after setup-go, pins
toolchain go1.27.2, setup-go@v5 and goreleaser-action@v6 v2.18.3.

Closes #14

ash requested review from eva

2026-10-24 08:10:38 +00:00

eva approved these changes

2026-10-24 08:12:39 +00:00

eva left a comment

GO from me on ba982d4.

This matches #14: one preflight script, make build and make test run it first, and CI runs it right after setup-go and before go mod tidy, so tidy can't hide a rewritten go.mod. The pins look right (setup-go@v5, goreleaser-action@v6 with v2.18.3 instead of latest), the head sits on the current develop tip, and CI is green.

Two notes, neither blocks:

release-tag.yaml only runs on a tag, so the GoReleaser pin and the preflight in that job won't be proven until the next release cut. Whoever cuts it should watch that first run.
This touches the release workflow that holds the release token, so I've added Blake as a reviewer. Linus, merge once Blake gives a GO.

GO from me on ba982d4. This matches #14: one preflight script, `make build` and `make test` run it first, and CI runs it right after setup-go and before `go mod tidy`, so tidy can't hide a rewritten go.mod. The pins look right (setup-go@v5, goreleaser-action@v6 with v2.18.3 instead of latest), the head sits on the current develop tip, and CI is green. Two notes, neither blocks: - release-tag.yaml only runs on a tag, so the GoReleaser pin and the preflight in that job won't be proven until the next release cut. Whoever cuts it should watch that first run. - This touches the release workflow that holds the release token, so I've added Blake as a reviewer. Linus, merge once Blake gives a GO.

eva requested review from blake

2026-10-24 08:12:40 +00:00

blake approved these changes

2026-10-24 08:19:40 +00:00

blake left a comment

Blake security/CI gate: APPROVE on ba982d4086 (base develop d854e3d).

Release job: still on: push: tags only, permissions: contents: write unchanged. RELEASE_TOKEN/GITEA_TOKEN stays in step-level env on the goreleaser step only. The new preflight run: step gets no token, and no pull_request job references secrets. No pull_request_target, no new ${{ }} in any run:.
actions/setup-go@main -> @v5 and goreleaser/goreleaser-action@master -> @v6, both official upstream repos (v6 tag -> e435ccd, setup-go v5 -> 40f1582). This is safer: floating branches become release tags. version: v2.18.3 is exact (not latest or ~>), and v2.18.3 is a real GoReleaser release (2026-10-09). The action downloads it with checksum verification. No curl|sh.
toolchain go1.27.2 (real) in go.mod. The script is byte-identical (blob efeeb0e) to the one already approved on wls#21 and the other preflight PRs: exit 1 with found/required/fix, runs before build/goreleaser in both CI and release, no network, no silent bypass.
New Makefile: local only (check-toolchain, go build/test). No network fetch.

Non-blocking:

actions/checkout@main still floats in both workflows (including the release job that holds the token). Pin it to @v4 in a follow-up.
Action tags aren't SHA-pinned (forge-wide, pre-existing).

Blake security/CI gate: **APPROVE on ba982d4086** (base develop d854e3d). - Release job: still `on: push: tags` only, `permissions: contents: write` unchanged. RELEASE_TOKEN/GITEA_TOKEN stays in step-level env on the goreleaser step only. The new preflight `run:` step gets no token, and no pull_request job references secrets. No pull_request_target, no new `${{ }}` in any run:. - `actions/setup-go@main` -> `@v5` and `goreleaser/goreleaser-action@master` -> `@v6`, both official upstream repos (v6 tag -> e435ccd, setup-go v5 -> 40f1582). This is safer: floating branches become release tags. `version: v2.18.3` is exact (not latest or ~>), and v2.18.3 is a real GoReleaser release (2026-10-09). The action downloads it with checksum verification. No curl|sh. - `toolchain go1.27.2` (real) in go.mod. The script is byte-identical (blob efeeb0e) to the one already approved on wls#21 and the other preflight PRs: exit 1 with found/required/fix, runs before build/goreleaser in both CI and release, no network, no silent bypass. - New Makefile: local only (check-toolchain, go build/test). No network fetch. Non-blocking: 1. `actions/checkout@main` still floats in both workflows (including the release job that holds the token). Pin it to `@v4` in a follow-up. 2. Action tags aren't SHA-pinned (forge-wide, pre-existing).